#!/bin/sh
set -eu

readonly FLUXIP_UID=10001
readonly FLUXIP_GID=10001

prepare_directory() {
    directory=$1
    mkdir -p "$directory"
    unsafe_entry=$(find "$directory" -xdev ! -type d ! -type f -print -quit)
    if [ -n "$unsafe_entry" ]; then
        echo "Refusing unsafe volume entry: $unsafe_entry" >&2
        exit 1
    fi
    find "$directory" -xdev -exec \
        chown --no-dereference "$FLUXIP_UID:$FLUXIP_GID" {} +
    find "$directory" -xdev -type d -exec chmod 0700 {} +
    find "$directory" -xdev -type f -exec chmod 0600 {} +
}

prepare_directory /app/data
prepare_directory /app/secrets
prepare_directory /app/backups

echo "FluxIP volume permissions prepared for UID $FLUXIP_UID"